check_point.mgmt.cp_mgmt_set_best_practice module – Edit an existing Best Practice using object name, uid or best practice id. Activate or deactivate the best practice and its relevant objects.

Note

This module is part of the check_point.mgmt collection (version 7.0.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install check_point.mgmt.

To use it in a playbook, specify: check_point.mgmt.cp_mgmt_set_best_practice.

New in check_point.mgmt 7.0.0

Synopsis

  • Edit an existing Best Practice using object name, uid or best practice id. Activate or deactivate the best practice and its relevant objects.

  • All operations are performed over Web Services API.

  • Available from R82.20 management version.

Parameters

Parameter

Comments

active

boolean

The activation status of the best practice.

Choices:

  • false

  • true

auto_publish_session

boolean

Publish the current session if changes have been performed after task completes.

Choices:

  • false ← (default)

  • true

best_practice_id

string

Best Practice ID.

deactivation_comment

string

The reason for deactivating the best practice.<br><font color=”red”>Required only if</font> active is set to false.

deactivation_expiration_date

string

When the deactivation expires. Date and time represented in international ISO 8601 format. Relevant only if deactivation-mode is set to ‘expire-on’.

deactivation_mode

string

Whether the deactivation never expires or expires on a specific date.<br><font color=”red”>Required only if</font> active is set to false.

Choices:

  • "never"

  • "expire-on"

details_level

string

The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed representation of the object.

Choices:

  • "uid"

  • "standard"

  • "full"

ignore_errors

boolean

Apply changes ignoring errors. You won’t be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.

Choices:

  • false

  • true

ignore_warnings

boolean

Apply changes ignoring warnings.

Choices:

  • false

  • true

name

string

Best Practice Name.

relevant_objects

dictionary

The relevant objects to activate or deactivate, each with its own deactivation settings. Supports the ‘update’ action only.

update

dictionary

Updates a value from a collection

deactivation_comment

string

The reason for deactivating the relevant object.<br><font color=”red”>Required only if</font> enabled is set to false.

deactivation_expiration_date

string

When the deactivation expires. Date and time represented in international ISO 8601 format. Relevant only if deactivation-mode is set to ‘expire-on’.

deactivation_mode

string

Whether the deactivation never expires or expires on a specific date.<br><font color=”red”>Required only if</font> enabled is set to false.

Choices:

  • "never"

  • "expire-on"

enabled

boolean

The activation status of the relevant object in the Compliance scan.

Choices:

  • false

  • true

name

string

The name of the relevant object to update, as shown in the ‘show-best-practice’ reply. For a security gateway relevant object, this is the security gateway name; for an access rule relevant object, this is the layer name.

version

string

Version of checkpoint. If not given one, the latest version taken.

wait_for_task

boolean

Wait for the task to end. Such as publish task.

Choices:

  • false

  • true ← (default)

wait_for_task_timeout

integer

How many minutes to wait until throwing a timeout error.

Default: 30

Examples

- name: set-best-practice
  cp_mgmt_set_best_practice:
    best_practice_id: FW164
    relevant_objects:
      update:
        deactivation_comment: Gateway excluded from this check.
        deactivation_mode: never
        enabled: false
        name: gw1

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

cp_mgmt_set_best_practice

dictionary

The checkpoint set-best-practice output.

Returned: always.

Authors

  • Dor Berenstein (@chkp-dorbe)